| Title: | reconstructing a packed dll binary for static analysis |
| Author: | Wang Xianggen
; Feng Dengguo
; Su Purui
|
| Source: | Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
|
| Conference Name: | 5th International Conference on Information Security Practice and Experience, ISPEC 2009
|
| Conference Date: | April 13,
|
| Issued Date: | 2009
|
| Conference Place: | Xian, China
|
| Keyword: | Computer crime
; Embedded systems
; Security of data
; Security systems
; Static analysis
|
| Publish Place: | Germany
|
| ISSN: | 3029743
|
| ISBN: | 3642008429
|
| Department: | (1) University of Science and Technology of China; (2) State Key Laboratory of Information Security, Institute of Software, Chinese Academy of Sciences
|
| Sponsorship: | Xidian University
|
| English Abstract: | DLLs (Dynamic Link Libraries) are usually protected by various anti-reversing engineering techniques. One technique commonly used is code packing as packed DLLs hinder static code analysis such as disassembly. In this paper, we propose a technique to reconstruct a binary file for static analysis by loading a DLL and triggering and monitoring the execution of the entry-point function and exported functions of packed DLLs. By monitoring all memory operations and control transfer instructions, our approach extracts the original hidden code which is written into the memory at run-time and constructs a binary based on the original DLL, the codes extracted and the records of control transfers. To demonstrate its effectiveness, we implemented our prototype ReconPD based on QEMU. The experiments show that ReconPD is able to analyze the packed DLLs, yet practical in terms of performance. Moreover, the reconstructed binary files can be successfully analyzed by static analysis tools, such as IDA Pro. © 2009 Springer Berlin Heidelberg. |
| Content Type: | 会议论文
|
| URI: | http://ir.iscas.ac.cn/handle/311060/8538
|
| Appears in Collections: | 信息安全国家重点实验室_会议论文
|
|
There are no files associated with this item.
|
| Recommended Citation: | |
Wang Xianggen,Feng Dengguo,Su Purui. reconstructing a packed dll binary for static analysis[C]. 见:5th International Conference on Information Security Practice and Experience, ISPEC 2009. Xian, China. April 13,.
|
|
|
